18.1 Create, Delete, and Modify Local User Accounts

Red Hat Certified System Administrator RHCSA

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Lab Setup & Performance-Based Study Strategy

2 Essential Tools: Shell, Redirection & Text Analysis

2.1 Shell Prompt and Command Syntax 2.2 Input-Output Redirection and Pipes 2.3 grep and Regular Expressions for Text Analysis

3 Essential Tools: Remote Access, Users & Text Editing

3.1 Access Remote Systems Using SSH 3.2 Log In and Switch Users in Multiuser Targets 3.3 Create and Edit Text Files

4 Essential Tools: Files, Links & Archives

4.1 Create, Delete, Copy, and Move Files and Directories 4.2 Hard and Soft Links 4.3 Archive and Compress with tar, gzip, and bzip2

5 Essential Tools: Permissions & System Documentation

5.1 List, Set, and Change Standard ugo/rwx Permissions 5.2 System Documentation: man, info, and /usr/share/doc

6 Manage Software: RPM and Flatpak

6.1 Configure Access to RPM Repositories 6.2 Install and Remove RPM Software Packages 6.3 Configure Access to Flatpak Repositories 6.4 Install and Remove Flatpak Software Packages

7 Create Simple Shell Scripts

7.1 Conditional Execution: if, test, and [] 7.2 Looping Constructs for Files and Input 7.3 Process Script Inputs ($1, $2, and Beyond) 7.4 Process Shell Command Output in Scripts

8 Operate Running Systems: Boot and Recovery

8.1 Boot, Reboot, and Shut Down a System Normally 8.2 Boot Systems into Different Targets Manually 8.3 Interrupt the Boot Process to Gain Access

9 Operate Running Systems: Processes and Tuning

9.1 Identify and Kill CPU/Memory Intensive Processes 9.2 Adjust Process Scheduling 9.3 Manage Tuning Profiles

10 Operate Running Systems: Logs, Services & File Transfer

10.1 Locate and Interpret System Log Files and Journals 10.2 Preserve System Journals 10.3 Start, Stop, and Check Status of Network Services 10.4 Securely Transfer Files Between Systems

11 Configure Local Storage: Partitions and LVM

11.1 List, Create, and Delete Partitions on GPT Disks 11.2 Create and Remove Physical Volumes 11.3 Assign Physical Volumes to Volume Groups 11.4 Create and Delete Logical Volumes

12 Configure Local Storage: Mounting and Expansion

12.1 Mount File Systems at Boot by UUID or Label 12.2 Add Partitions, Logical Volumes, and Swap Non-Destructively

13 Create and Configure File Systems: Local FS and Permissions

13.1 Create, Mount, and Use VFAT, ext4, and XFS File Systems 13.2 Extend Existing Logical Volumes 13.3 Diagnose and Correct File Permission Problems

14 Create and Configure File Systems: NFS and autofs

14.1 Mount and Unmount Network File Systems Using NFS 14.2 Configure autofs

15 Deploy and Maintain: Scheduling, Services & Targets

15.1 Schedule Tasks with at, cron, and systemd Timers 15.2 Start, Stop, and Enable Services at Boot 15.3 Configure Systems to Boot into a Specific Target

16 Deploy and Maintain: Time, Software Updates & Bootloader

16.1 Configure Time Service Clients 16.2 Install and Update Software from CDN, Remote Repos, and Local Files 16.3 Modify the System Bootloader

17 Manage Basic Networking

17.1 Configure IPv4 and IPv6 Addresses 17.2 Configure Hostname Resolution 17.3 Configure Network Services to Start Automatically at Boot 17.4 Restrict Network Access Using firewalld and firewall-cmd

18 Manage Users and Groups

18.1 Create, Delete, and Modify Local User Accounts 18.2 Change Passwords and Adjust Password Aging 18.3 Create, Delete, and Modify Local Groups and Memberships 18.4 Configure Privileged Access

19 Manage Security: Firewall, umask & SSH Keys

19.1 Configure Firewall Settings with firewall-cmd and firewalld 19.2 Manage Default File Permissions 19.3 Configure Key-Based Authentication for SSH

20 Manage Security: SELinux Modes and Contexts

20.1 Set Enforcing and Permissive Modes for SELinux 20.2 List and Identify SELinux File and Process Contexts 20.3 Restore Default File Contexts

21 Manage Security: SELinux Ports and Booleans

21.1 Manage SELinux Port Labels 21.2 Use Boolean Settings to Modify SELinux Settings

18.1 Create, Delete, and Modify Local User Accounts

Key Takeaways Explain This Topic AI

Create local accounts with useradd; set UID (-u), primary group (-g), supplementary groups (-G), home (-d/-m), shell (-s), and comment (-c) to match the task exactly.

Modify accounts with usermod; always use usermod -aG to append supplementary groups—usermod -G alone replaces the full supplementary set.

Delete with userdel; add -r when the home directory and mail spool must be removed as part of the end state.

Account truth lives in /etc/passwd, /etc/shadow, and /etc/group; verify with id, getent passwd, and ls -ld on the home path.

useradd does not replace passwd for setting a login password—create the account, then set or age the password as required.

Last updated: August 2026

18.1 Create, Delete, and Modify Local User Accounts

Quick Answer: Create accounts with useradd (options for home, shell, UID, groups, comment). Modify with usermod . Remove with userdel (add -r to remove home and mail spool). Verify in /etc/passwd , /etc/shadow , /etc/group , and with id , getent passwd , and ls -ld /home/user . Defaults come from /etc/login.defs and /etc/default/useradd .

Why local users matter on EX200

Under Manage users and groups , Red Hat expects you to create, delete, and modify local user accounts so people and service identities exist with the right UID, home, shell, and group memberships. Tasks look like:

“Create user ops1 with UID 1500, home /home/ops1 , and shell /bin/bash .”
“Add a comment (GECOS) and force the account to use /sbin/nologin .”
“Delete user temp and remove the home directory.”

“Lock an account” or “change the primary group / supplementary groups” (often with password and group objectives in the same scenario).

You are graded on end state in the account databases and filesystem , not on interactive GUI tools. Prefer useradd / usermod / userdel over hand-editing /etc/passwd under exam pressure.

Account databases (what you are changing)

File Role
/etc/passwd Public account map: name, UID, GID, GECOS, home, shell
/etc/shadow Password hashes and aging fields (root-readable)
/etc/group Group names, GIDs, member lists
/etc/gshadow Group passwords / admins (less common on exam tasks)

/etc/login.defs Defaults: UID/GID ranges, password aging defaults, CREATE_HOME , etc.

/etc/default/useradd useradd defaults (HOME, SHELL, SKEL, INACTIVE, …)
/etc/skel/ Skeleton files copied into new homes getent passwd alice
getent shadow alice # as root; may be restricted
id alice
ls -ld /home/alice

getent uses NSS (Name Service Switch)—prefer it over only cat /etc/passwd so you see the same resolution path the system uses. On pure local EX200 machines, local files dominate.

/etc/passwd fields name:x:UID:GID:GECOS:home:shell
alice:x:1001:1001:Alice Admin:/home/alice:/bin/bash

Field Meaning
name Login name
x Password placeholder (real secret in shadow)
UID Numeric user id
GID Primary group id
GECOS Comment (full name, room, etc.)
home Home directory path
shell Login shell program
System vs ordinary UIDs

RHEL/ login.defs define ranges ( UID_MIN , UID_MAX , system ranges). System accounts (daemons) often use lower UIDs and /sbin/nologin or /bin/false . Ordinary interactive users typically get UIDs ≥ UID_MIN (commonly 1000). If a task specifies a UID , set it explicitly with useradd -u .

Create users with useradd
Minimal create sudo useradd alice
id alice
getent passwd alice
ls -ld /home/alice # if CREATE_HOME is yes

Without extra options, useradd applies defaults from /etc/default/useradd and /etc/login.defs (primary group strategy, home creation, shell, skeleton).

Essential options (memorize)

Option Purpose
u UID Fixed user ID
g GROUP Primary group (name or GID)—group must exist
G g1,g2 Supplementary groups at create time
c "Comment" GECOS / comment field
d /path Home directory path
m Create home (and copy skel) when not default
M Do not create home
s /shell Login shell
r System account (system UID range; often no aging the same way)
e YYYY-MM-DD Account expiration date
f INACTIVE Days after password expire until account inactive
p HASH Pre-hashed password (prefer passwd interactively on exam)
k SKEL Alternate skeleton directory
b BASE Base directory for home (e.g. /home ) sudo groupadd developers 2>/dev/null || true
sudo useradd -u 1500 -g developers -G wheel -c "Ops Alice" \
d /home/alice -m -s /bin/bash alice
id alice
getent passwd alice
ls -la /home/alice

Order habit: create required groups first , then useradd -g / -G . Primary group with -g must already exist unless you rely on the default “user private group” behavior.

User private groups (UPG)

On modern RHEL, creating alice often creates a group alice with the same GID as the UID and sets that as primary. That isolates default file group ownership. Tasks that say “primary group must be developers ” require -g developers (and usually that group already exists). grep ^USERGROUPS_ENAB /etc/login.defs

grep ^GROUP= /etc/default/useradd
Home and skeleton ls -la /etc/skel
sudo useradd -m -k /etc/skel bob
ls -la /home/bob

-m ensures the home directory is created and populated from skel. If home should live outside /home : sudo useradd -d /srv/appuser -m -s /sbin/nologin appuser

ls -ld /srv/appuser

Non-login / service-style accounts sudo useradd -r -s /sbin/nologin -c "App runtime" -d /var/lib/myapp -m myapp

getent passwd myapp

-r requests a system account. Shell /sbin/nologin or /usr/sbin/nologin blocks interactive login while still allowing ownership of files and services.

Modify users with usermod # Common modifications
sudo usermod -c "New Comment" alice
sudo usermod -s /bin/bash alice
sudo usermod -d /home/alice2 -m alice # -m moves home content when changing -d
sudo usermod -u 1600 alice # change UID (files keep old numeric ownership!)
sudo usermod -g developers alice # change primary group
sudo usermod -L alice # lock password
sudo usermod -U alice # unlock
sudo usermod -e 2026-12-31 alice # account expire date
sudo usermod -f 7 alice # inactive days after password expire
Supplementary groups: replace vs append

Command Effect
usermod -G g1,g2 alice Sets supplementary groups to exactly g1,g2 (drops others)
usermod -aG g1 alice Appends g1 without removing existing supplementary groups

Exam trap: Forgetting -a with -G wipes previous supplementary memberships (for example silently removing wheel ). Always: id alice

sudo usermod -aG projectx alice
id alice

Primary group is not listed the same way as supplementary in all tools—use id and groups .

Locking vs deleting sudo usermod -L alice # lock: '!' or '!!' in shadow password field
sudo passwd -l alice # also locks via passwd
sudo passwd -u alice # unlock (if a password hash exists)
sudo usermod -s /sbin/nologin alice # block interactive shell without deleting

Locking is for temporary disable. Deleting is permanent removal of the account entry.

Delete users with userdel sudo userdel alice # remove account; home may remain
sudo userdel -r alice # remove home directory and mail spool

Option Purpose
r Remove home and mail spool
f Force (e.g. if user still logged in)—use carefully

Exam reading: If the task says remove the user and home directory, you need userdel -r . Without -r , leftover /home/alice with orphaned UID ownership is a common miss. getent passwd alice || echo "no passwd entry"

ls -ld /home/alice 2>/dev/null || echo "home gone"
find / -xdev -uid 1500 2>/dev/null | head # leftover files if UID known

After userdel without -r , you may need manual rm -rf of home only if the task requires cleanup—prefer userdel -r when that matches the requirement.

Inspect defaults before you fight the tools sudo useradd -D # show useradd defaults
sudo cat /etc/default/useradd
grep -E '^(UID_MIN|UID_MAX|CREATE_HOME|SYS_UID)' /etc/login.defs

Changing global defaults mid-exam is rarely required; per-user options on the command line are safer and clearer for graders.

Password is separate (but often same task)

useradd does not set a usable interactive password unless you pass a carefully prepared hash. Typical exam flow: sudo useradd -m -s /bin/bash alice

echo 'AlicePass123' | sudo passwd --stdin alice # RHEL passwd supports --stdin
# or: sudo passwd alice # interactive

Password aging and chage are Section 18.2 . Create the account correctly first, then set password/aging as specified.

Ownership after UID change

If you change UID with usermod -u , files already owned by the old numeric UID do not magically rewrite. For a home you control: sudo usermod -u 1600 alice

sudo chown -R alice:alice /home/alice

On the exam, set the correct -u at create time whenever the task specifies a UID—avoid mid-flight UID renumbering.

Verification checklist (grader style) id alice
getent passwd alice
getent group developers
ls -ld /home/alice
grep '^alice:' /etc/passwd
sudo grep '^alice:' /etc/shadow

Check every field the task mentioned: name, UID, primary GID/group, supplementary groups, home path existence, shell, comment .

Exam workflows

Workflow A — Interactive user with exact UID and shell sudo useradd -u 1500 -c "Ops Alice" -m -s /bin/bash alice

echo 'ExamP@ss1' | sudo passwd --stdin alice
id alice
getent passwd alice
Workflow B — Primary group + supplementary groups at create sudo groupadd -f developers
sudo groupadd -f contractors
sudo useradd -m -s /bin/bash -g developers -G contractors,wheel bob
id bob
Workflow C — Service account without login sudo useradd -r -m -d /var/lib/svcapp -s /sbin/nologin svcapp
id svcapp
getent passwd svcapp
Workflow D — Modify existing: shell, comment, append group sudo usermod -s /bin/bash -c "Bob Ops" bob
sudo usermod -aG wheel bob
id bob
Workflow E — Delete including home sudo userdel -r tempuser
getent passwd tempuser || echo removed
ls /home/tempuser 2>/dev/null || echo home removed
Common traps

usermod -G without -a wiping supplementary groups (especially wheel ).

userdel without -r when the task requires home removal.

Specifying -g primary group that does not exist —create the group first.

Assuming useradd sets a password —still run passwd .

Wrong shell path: prefer /bin/bash , /sbin/nologin as commonly used on RHEL.

Creating home with wrong path and forgetting -m / -d .

Hand-editing /etc/passwd and breaking field counts—use the tools.

Changing UID and forgetting file ownership still shows old numbers.

Expecting group membership to apply in a session that was already open—user must re-login for new groups in interactive sessions.

Skipping id / getent verification before moving to the next task.

Relationship to other sections

18.2 Password aging: passwd and chage after the account exists.

18.3 Groups: groupadd / gpasswd / membership details.

18.4 Privileged access: wheel and sudo depend on correct group membership.

Permissions chapters: files you create as root under a user’s home often need chown .

SSH / multiuser login: shell and account lock state affect interactive access.

Section checkpoint

You should create local users with useradd (UID, home, shell, comment, primary/supplementary groups), modify them with usermod (especially -aG vs -G ), lock when required, delete with userdel / userdel -r , and prove results with id , getent , and home directory checks against /etc/passwd and /etc/shadow . That is the EX200 bar for local user accounts on RHEL 10.